That's what they did to upload a repo, the question is why they would upload the user's entire repo in the first place. The idea itself is egregious, and the implementation was horrifying on top of that.
The entire directory (not repo) and all repo history regardless of secrets or instructions otherwise is not needed for faster cache access. I'm not going to say that this was intentional exfiltration. Sneaky motivations are not needed for this to be a bad idea and a horrific implementation.